A software platform on an electronic device is an operating system or a runtime environment (like Java or a mobile agent platform) by which software is loaded and executed. A typical piece of software is, for example, a game application that can be executed on a device with a suitable software platform. In order to provide a wide variety of compatible devices and software applications, different manufacturers may use the same software platform on their products. While the software platform or operating system is thus similar or even identical, the products equipped with it, however, usually comprise very specific hardware. Also, while the core of the platform software might be identical, there are lots of other parts like devices drivers which may not be identical or even at all present in different electronic devices.
So a situation may occur where a software application is to be executed on a device with an unsuitable software platform or hardware. Some reasons for unsuitability are, for example, an insufficient amount of Random-Access Memory (RAM) for storing the needed data, a display without an adequate resolution and/or number of colours, missing online connectivity (W-LAN, bluetooth etc.), or a keyboard not including adequate control and action keys. If any of these requirements are not fulfilled, using the respective application on such a device might not be satisfactory for the user and he will be dissatisfied with the purchased piece of software. In some cases running an application on a wrong device may even result in loss of user data and or malfunctions of the device possibly requiring costly repair services.
Generally there also exists another kind of threat regarding software platforms and imported software, i.e. software from an external source, i.e. malicious software, or so-called “malware”. A lot of attention has been paid to different kinds of methods for a software platform to verify the integrity of imported software. However also the inverse situation may be regarded, i.e., that the software platform may also subvert the operation of imported software. At the moment many protection schemes are based on different kinds of identifications such as device ID or Multi Media Card ID. In other words, the software application relies on a certain piece of platform software to retrieve a needed ID. If an attacker is able to spoof the needed ID, the whole protection scheme falls apart. Therefore the application itself should be able to verify that it is installed on a device that is able and authorized to run it.
In the state of the art a software application can verify the integrity of the software platform by computing a cryptographic hash for a selected software module of the platform software and comparing the hash with a hash contained in the verification routine of the software application. If the hashes correspond to each other the platform is successfully verified and the software application can be executed on the device. The selected software module may be, for example, software like device drivers or some other piece of software that is needed for running the application. The disadvantage of the conventional approach with a fixed expected hash value in the application is that any updates or replacements of a software module of the platform lead to a negative verification of the platform, which, in turn, results in non-execution of older applications. As it is rather common that the software of electronic devices like mobile phones and the like will have to be updated during their lifetime, e.g. to remove security flaws and software errors, such a conventional approach is not suitable to deal with these demands.
Therefore it is an object of the invention to remove or at least alleviate the problems discussed above.